We‘ve been writing a tool to check lock files against the registry: https://www.npmjs.com/package/@gitlab/untamper-my-lockfile

For now it only supports yarn, but npm support shouldn’t be too hard.